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Top Stories 

• The governor of Oklahoma issued a state of emergency for all 77 counties following a 
severe storm November 28 that caused severe flooding, left 14 people dead, and knocked 
out electricity to more than 100,000 customers. - USA Today (See item 1) 

• The U.S. Air Force hired civilian defense contractors to fly MQ-9 Reaper drones in order 
to provide intelligence, surveillance, and reconnaissance (ISR) in global hot spots to help 
track suspected militants and other targets November 27. - Los Angeles Times (See item 4 ) 

• At least 1 police officer and 2 civilians were killed and at least 4 other officers and 5 
civilians were injured November 27 after a gunman opened fire for several hours at a 
Planned Parenthood clinic in Colorado Springs. - Washington Post (See item 23 ) 

• Hong-Kong based VTech Holdings Ltd reported that 5 million customers’ accounts and 
related children’s profiles were compromised worldwide after a breach in its database 
exploited customers’ personal information. - Reuters (See item 30 ) 
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Energy Sector 



1. November 30, USA Today - (National) Okla. declares state of emergency amid 
winter storm, flooding. A severe storm the weekend of November 28 that moved 
across Texas, Oklahoma, Arkansas, and Tennessee left 14 people dead, knocked out 
electricity to more than 100,000 customers, and forced the governor of Oklahoma to 
declare a state of emergency for all 77 counties due to flooding. 

Source: http://www.msn.com/en-us/news/weather/okla-declares-state-of-emergency- 
amid- winter-storm- flooding/ar-AAfNeGf 

Chemical Industry Sector 

2. November 30, WECT 6 Wilmington - (North Carolina) Roads reopen, cleanup near 
complete after 20,000 gallon methanol spill. Wilmington officials reported that over 
20,000 gallons of liquid methanol spilled November 29 near the Colonial Terminals 
Company after a valve was accidentally left open, causing a tank to overflow. Crews 
remained on site November 20 monitoring the chemical and reported there were no 
safety concerns to the public. 

Source: http ://w w w . wect .com/story/3062605 6/happening-no w-20000- gallon-methanol- 
spill-closes-parts-of-front-street 

Nuclear Reactors, Materials, and Waste Sector 

3. November 28, WGAL 8 Lancaster - (Pennsylvania) Three Mile Island returned to 
service after refueling. Exelon Generation Corporation-owned Three Mile Island 
Generating Station restored full power to its Unit 1 nuclear reactor at its Londonderry 
Township facility November 27 following an October 30 outage that performed tests, 
inspections, and maintenance activities and replaced about one-third of the reactor’s 
fuel. 

Source: http://www.wgal.com/news/three-mile-island-retumed-to-service-after- 
refueling/36694344 

Critical Manufacturing Sector 

Nothing to report 

Defense Industrial Base Sector 

4. November 27, Los Angeles Times - (International) Air Force hires civilian drone 
pilots for combat patrols; critics question legality. The U S. Air Force announced 
November 27 that it hired civilian defense contractors to fly MQ-9 Reaper drones to 
conduct combat air patrols, daily round-the-clock flights above areas of military 
operations, in order to provide intelligence, surveillance, and reconnaissance (ISR) in 
global hot spots to help track suspected militants and other targets. The civilians are not 
combatants and are not allowed to pinpoint targets or fire missiles. 

Source: http://www.latimes ■com/nation/la-fg-drone-contractor-20 1511 27-story.html 
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5. November 27, Federal Times - (Florida) Florida contractor pleads guilty for tax 
fraud scheme. The U.S. Department of Justice reported that a Fort Lauderdale man 
pleaded guilty November 24 to a $1.7 million tax fraud scheme in which he underpaid 
corporate and individual income tax by hiding funds, and committed his activities 
through his company, Simplex Corporation, a company that provided aircraft parts to 
U.S. military deployed overseas. The contractor admitted to making illegal payments to 
a government contract and U.S. military personnel. 

Source: 

http://www.federaltimes.com/storv/government/management/oversight/2015/ll/27/fior 

ida-contractor-pleads-guilty-tax-fraud-scheme/76383472/ 

Financial Services Sector 

6. November 29, Associated Press - (National) Man charged with $1.4 million 
MoneyGram embezzlement. Authorities in the U.S. Virgin Islands arrested a man 
November 29 for allegedly embezzling $1.4 million from his former employer, 
MoneyGram International Incorporated after failing to deposit a $1.4 million check into 
a company account and using the funds for personal use. 

Source: http://abcnews.go.com/Intemational/wireStory/man-charged-14-million- 
money gram-embezzlement-35477325 

7. November 25, U.S. Department of the Treasury - (International) Treasury sanctions 
networks providing support to the Government of Syria, including for facilitating 
Syrian government oil purchases from ISIL. The U.S. Department of the Treasury 
designated 4 individuals and 6 entities November 25 for allegedly providing support to 
the Government of Syria as well as indirectly supporting the Islamic State of Iraq and 
the Levant (ISIL) through oil sales. The designation froze U.S. assets of the suspects, 
who have business operations in Belize, Russia, and Syria. 

Source: https://www.treasury.gov/press-center/press-releases/Pages/il0287.aspx 

8. November 25, U.S. Department of Justice - (Texas) Federal Jury Convicts San 
Antonio Businessman in Estimated $3.9 Million Tax Fraud Scheme. A Federal jury 
convicted the former owner of San Antonio-based Gourmet Express LLC November 25 
for conspiring with family members to defraud the U.S. Internal Revenue Service of 
approximately $3.9 million between 2001 and 2009 by using shell companies in 
Thailand to over-report prices paid abroad for goods, while siphoning off funds for 
personal use. 

Source: http://www.iustice.gov/usao-wdtx/pr/federal-iurv-convicts-san-antonio- 
businessman-estimated-39-million-tax-fraud-scheme 



For another story, see item 5 

Transportation Systems Sector 



9. November 30, KNXV 15 Phoenix - (Arizona) MCSO: Five people dead after two car 
collision in Sun Lakes. Five people were killed in a head-on collision near Hunt 
Highway and Dobson Road in Sun Lakes November 29, prompting the highway’s 
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closure for several hours while authorities investigated the incident. 

Source: http://www.abcl5.com/news/region-southeast-valley/chandler/mcso-fatal-car- 
collision-in-sun-lakes-closes-down-roads 



10. November 30, Richmond Times -Dispatch - (Virginia) State police say speed was a 
factor in Chesterfield bus crash. Southbound lanes on the Powhite Parkway in 
Chesterfield County were restricted for several hours November 29 following an 
accident involving an overturned tour bus on the southbound ramp of the parkway 
which sent 33 passengers to area hospitals with injuries. 

Source: http://www.richmond.com/news/local/traffic/article 5652e7ac-2d 17-546 1- 
979f-102c5672ceb4.html 

11. November 30, KBTX 3 Bryan/College Station - (Texas) Highway 6 lanes open again 
after major accident. Highway 6 in College Station reopened after closing for over 2 
hours November 29 following 3 separate chain-reaction crashes involving 17 vehicles. 
Source: http://www.kbtx.com/news/headlines/Major-Accident-Shuts-Down-Highway- 
6-358355821.html 

12. November 29, Associated Press - (New Jersey) 3 dead in crash involving car, van, 
truck hauling cows. Three people were killed and more than 12 others were injured 
following a crash involving 3 vehicles on Interstate 287 in Bernards Township 
November 29, prompting the closure of the interstate for several hours while officials 
investigated. 

Source: http://6abc.com/news/3-dead-in-crash-involving-car-van-truck-hauling- 
cows/1 102887/ 

13. November 29, inForney.com - (Texas) Heavy rains cause levee failure and road 
closures across Kaufman County, threaten highway closure. Heavy rains caused the 
closure of 8 county roads and flooded approximately 3,200 acres in Kaufman County 
after a levee along the East Fork Trinity River failed November 29. 

Source: http://inforney.com/local-news/item/3953-heavv-rains-cause-levee-failure-and- 
road-closures-across-kaufman-county-threaten-highway-closure 

14. November 28, KSL 5 Salt Lake City - (Utah) Tanker crash sends oil into Provo River 
as snow and ice create hazards. U.S. 189 near Vivian Park in Provo Canyon was 
closed for at least 8 hours November 28 due to an accident involving a semi-truck 
carrying two oil tankers that crashed and spilled about 4,500 gallons of oil. Hazardous 
road conditions caused over 200 accidents along the Wasatch Front. 

Source: http://www.ksl.com/?sid=37547231&nid=148&title=semi-overturns-in-provo- 
canyon-oil-leaks-into-provo-river 

15. November 28, Mat-Su Valley Frontiersman - (Alaska) Parks reopened after closing 
for Saturday morning wreck. Parks Highway in Wasilla was closed for more than 2 
hours November 28 while officials investigated the scene of a 2-vehicle crash that left 3 
people injured. 

Source: http://www.frontiersman.com/for the record/parks-reopened-after-closing-for- 
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saturday-morning- wreck/article 0214ab98-9605-lle5-a5fd-cf310b93229b.html 



16. November 28, WITN 7 Washington - (North Carolina) Man listed in critical condition 
after accident that closed Hwy 11. Highway 11 in Pitt County was closed for several 
hours November 27 following a 2-vehicle crash involving a car and a semi-truck that 
sent 1 driver to the hospital in critical condition. 

Source: http://www.witn.com/home/headlines/Vehicle-crash-closes-Highway-ll- 



356281281.html 



For another story, see item 27 

Food and Agriculture Sector 

17. November 30, Associated Press - (New York) NYC's novel salt warning rule set to 
take effect at chains. The New York City Board of Health announced November 30 
that restaurants will be required starting from December 1 to put a salt shaker symbol 
next to certain sandwiches, salads, and other items that contain more than the 
recommended sodium intake of 2,300 milligrams after the Board made the decision 
September 2015. 

Source: http://www.msn.com/en-us/news/us/nycs-novel-salt-waming-rule-set-to-take- 
effect-at-chains/ar-AAfOctm 



18. November 28, U.S. Department of Agriculture - (California) Mama Lina’s Inc. recalls 
Beef and Chicken Empanada products produced without benefit of inspection. San 

Diego-based Mama Lina’s Inc., recalled 1,754 pounds of beef, chicken, sweet wine 
beef, and chipotle chicken empanadas November 27 after routine testing by the U.S. 
Department of Agriculture (USDA) found that products produced by another leasing 
entity of Mama Lina’s Inc., were distributed without the marks of USDA inspection. 
The products were distributed to retail locations in San Diego. 

Source: http://www.fsis.usda.gov/wps/portal/fsis/topics/recalls-and-public-health- 
alerts/recall-case-archive/archive/201 5/recall- 144-2015-release 



19. November 27, Associated Press - (Pennsylvania) 20 tons of beef stolen in meat plant 
heist. Pennsylvania State Police reported November 27 that a trucker used a fake ID 
and vehicle registration to pick up a scheduled delivery of 40,000 pounds of beef worth 
$110,000 from Nicholas Meat in Loganton November 21. Authorities are investigating 
the incident after the trucker failed to show up at the shipment’ s final destination in 
Wisconsin. 

Source: http://www.cbsnews.com/news/20-tons-of-beef-burgled-in-pennsylvania-meat- 
plant-heist/ 

20. November 25, U.S. Department of Agriculture - (International) USDA releases final 
rule establishing inspection program for Siluriformes fish, including catfish. The 
U.S. Department of Agriculture (USDA) announced November 25 that a new 
inspection program will be in effect for imported and domestically-raised fish of the 
order Siluriformes, including catfish, as laid out in the 2014 Farm Bill. After a 
transitional period of 18 months, the USDA will begin to conduct species and residue 
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testing, previously done by the U.S. Food and Drug Administration. 

Source: http://www.fsis.usda.gov/wps/portal/fsis/newsroom/news-releases-staternents- 
and-transcripts/news-release-archives-by-year/archive/201 5/nr- 1125 15-01 

Water and Wastewater Systems Sector 

21. November 30, Marion Star - (Ohio) Boil alert issued Sunday night. A boil water 
advisory was issued for approximately 17,000 Aqua Ohio customers in Marion and the 
villages of Caledonia November 30 due to a filter malfunction at the Marion water 
treatment plant that caused high levels of cloudiness in water exiting the plant. The 
advisory will be removed once tests results show no that no bacteria is present. 

Source: http://www.marionstar.com/story/news/local/2015/ll/29/boil-alert-issued- 
sunday-night/76544088/ 

22. November 29, KXXV 25 Waco - (Texas) Residents in Marlin still without water 
Sunday. About 3,000 residents in Marlin remained without water service November 29 
after a mechanical issue at the city’s water treatment plant November 27 caused filters 
to clog, which cut down water production. Utility crews worked to pump water into the 
town with no estimated time for the restoration of service. 

Source: http://www.kxxv.com/storv/30618379/marlin-should-get-water-back-saturdav 
For another story, see item 1 

Healthcare and Public Health Sector 

23. November 28, Washington Post - (Colorado) Gunman kills officer, two others at 
Planned Parenthood clinic in Colorado. At least 1 police officer and 2 civilians were 
killed and at least 4 other officers and 5 civilians were injured November 27 after a 
gunman entered a Planned Parenthood clinic in Colorado Springs and opened fire in an 
hours-long shooting standoff before surrendering to police. Several surrounding 
businesses were told to take cover and remain indoors during the incident. 

Source: https://www.washingtonpost.com/world/national- 
security/2015/1 !/27/ff579e40-9543-l Ie5-b5e4-279b4501e8a6 story.html 

Government Facilities Sector 

24. November 29, WLS 7 Chicago - (Illinois) Online gun threat prompts University of 
Chicago closure Monday. The University of Chicago campus in Illinois and 
surrounding institutions were closed until at least November 30 following an online 
threat of gun violence on the campus that was received November 29. University 
officials are working with the FBI to investigate the threat. 

Source: http://abc7chicago.com/news/online-gun-threat-prompts-university-of-chicago- 
closure-monday/1 103467/ 

For additional stories, see items 4 and 5 
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Emergency Services Sector 



25. November 30, KTVX 4 Salt Lake City/KUCW 30 Salt Lake City - (Utah) Lockdown 
lifted at Salt Lake County Jail. The Salt Lake County Jail in Utah was released from 
lockdown November 30 following two occurrences in which a guard was assaulted by 
an inmate and transported to an area hospital with injuries November 27, and an assault 
in which two other staffers were injured November 28. 

Source: http://www.good4utah.com/news/top-stories/salt-lake-countv-iail-under- lock- 
down 



Information Technology Sector 

26. November 30, Securityweek- (International) Microsoft unveils protection against 
potentially unwanted applications. Microsoft released a new feature for its Systems 
Center Endpoint Protection (SCEP) and Forefront Endpoint Protection (FEP) systems 
that includes a new potentially unwanted application (PUA) protection program that 
automatically identifies unwanted software containing threat names, such as 
PUA:Win32/Creprote, that targets software bundling technologies, PUA applications, 
and PUA frameworks and decreases the amount of adware, toolbars, or other malicious 
applications that can be installed. 

Source: http ://w w w . securitvweek.com/microsoft-unveils-potentially-unwanted- 
application-protection-enterprises 

27. November 30, Securityweek - (International) Insecure app exposed Billboard Lights 
to hacker attacks. A security researcher reported that the SmartLink Android App to 
remotely control highway billboard sign lights had several vulnerabilities, including 
authentication flaws that can allow attackers to bypass the authentication mechanism 
and gain access to SmartLink customers’ data, perform man-in-the middle (MitM) 
attacks, and access web directories including files containing the application 
programming interface (API) source code and log files containing user login 
information. 

Source: http://www.securityweek.com/insecure-app-exposed-billboard-lights-hacker- 
attacks 



28. November 28, Softpedia - (International) DecryptorMax ransomware decrypted, no 
need to pay the ransom. A security researcher from Emisoft created a new tool 
dubbed Decryptlnfinite that decodes files encrypted by the DecryptorMax ransomware, 
also known as Cryptlnfinite, which allows infected users to obtain encrypted 
information without paying the ransom by using at least one file in its unencrypted 
form to drag and drop over the tool’s main window. 

Source: http://news.softpedia.com/news/decrvptormax-ransomware-decrypted-no-need- 
to-pay-the-ransom-496848.shtml 

29. November 27, Securityweek - (International) Critical vulnerability patched in Zen 
Cart. Zen Cart, the open source shopping cart software, released patches for several of 
its vulnerabilities including several cross-site scripting (XSS) vulnerabilities in the 
“order-comments” fields and the administration edit fields; a PHP file inclusion 
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vulnerability which allowed remote attackers to exploit the / ajax.php file to execute 
arbitrary PHP code and gain unlimited access to databases and files; as well as a low 
severity vulnerability that caused incorrect passwords to remain in the password field 
following a failed login attempt. 

Source: http://www.securitvweek.com/critical-vulnerability-patched-zen-cart 
For another story, see item 30 



Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 



Communications Sector 

Nothing to report 

Commercial Facilities Sector 

30. November 30, Reuters - (International) Data breach at Hong Kong toy maker VTech 
highlights broader problems. Hong-Kong based VTech Holdings Ltd, a company that 
sells electronic toys, reported that 5 million customers’ accounts and related children’s 
profiles were compromised worldwide after a breach in its database exploited 
customers’ names, email addresses, passwords, secret questions, and Internet Protocol 
(IP) addresses, among other information. VTech officials notified all account holders of 
the breach and reported that credit card information, ID card numbers, Social Security 
numbers, and drivers’ license numbers were unaffected. 

Source: http://www.reuters.com/article/2015/ll/30/us-vtech-cyberattack- 
idUSKBN0TJ0B620151130#iBqELHme53sfrHDX.97 

31. November 29, KHOU 11 Houston - (Texas) 12 hospitalized after gas leak at 
apartment complex. Houston officials reported November 29 that 12 residents from 
the Vista on Gessner apartments were sent to area hospitals for carbon monoxide 
poisoning November 28 after officials deemed an issue with a vent, serving a bank of 
gas dryers, caused the toxic gas to flow throughout the entire apartment building. 
CenterPoint Energy officials cut off all natural gas to the entire complex until the 
building utility company ensures the ventilation system is functioning properly. 

Source: http://www.khou.com/storv/news/local/2015/ll/28/residents-hospitalized- 
after-unknown-leak-sw-houston-apartment-complex/765 14874/ 

32. November 29, Montgomery Raycom News Network; WMTW 8 Poland Spring; Natchez 
Democrat; WGME 38 Portland; Elmira Star-Gazette - (National) Walmart stores in 
several states evacuated by automated bomb threats. Five Walmart stores in 
Louisiana, Maine, and New York were closed or evacuated November 28 after police 
received phoned bomb threats for several Walmart stores. Officials found no explosive 
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devices and cleared the facilities. 

Source: http://www.wfsb.com/storv/30622373/walmart-stores-in-several-states- 
evacuated-by-automated-bomb-threats 

33. November 28, CNBC - (National) Neiman Marcus suffers extended black Friday 
outage. Neiman Marcus officials reported that its homepage Web site was offline for 
several hours November 27 following an outage that left error messages when 
customers viewed its Web pages. The error was fixed November 28. 

Source: http://www.cnbc.eom/2015/l 1/27/neiman-marcus-suffers-extended-black- 
friday-outage.html 

34. November 28, The Janesville Gazette - (Wisconsin) Bomb threat prompts evacuation 
of Janesville Mall. The Janesville Mall in Wisconsin was evacuated and closed for 
nearly 2 hours November 28 while police crews cleared the building of any explosive 
devices following a bomb threat made via Facebook. Authorities found no suspicious 
devices and deemed the building safe. 

Source: 

http://www.gazettextra.com/20151128/bomb threat prompts evacuation of janesville 
mall 



35. November 27, Rawlins Daily Times; Rock Springs Rocket-Miner - (Wyoming) Rawlins 
Walmart evacuated Friday afternoon. A Rawlins Walmart was evacuated and closed 
November 27 for approximately 2 hours after Rawlins Police Department received a 
phoned bomb threat. Officials found no traces of explosive devices and are 
investigating a series of bomb threats targeting Walmart across the nation. 

Source: http://www.rawlinstimes.com/news/2015/ll/rawlins-walmart-evacuation- 
possibly-part-of-multi-store-bomb-threats-in-several-states/ 

For another story, see item 23 

Dams Sector 

See item 13 
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NTAS 

NO ACTIVE ALERTS 

www.DHS.gov/alerts 



Department of Homeland Security (DHS) 

DHS Daily Open Source Infrastructure Report Contact Information 

About the reports - The DHS Daily Open Source Infrastructure Report is a daily [Monday 
through Friday] summary of open-source published information concerning significant critical 
infrastructure issues. The DHS Daily Open Source Infrastructure Report is archived for 10 days on 
the Department of Homeland Security Web site: http://www.dhs.gov/lPDailvReport 

Contact Information 

Content and Suggestions: Send mail to cikr.productfeedback@hq.dhs.gov or contact the DHS 

Daily Report Team at (703) 942-8590 

Subscribe to the Distribution List: Visit the DHS Daily Open Source Infrastructure Report and follow 

instructions to Get e-mail updates when this information changes . 

Removal from Distribution List: Send mail to support@govdeliverv.com . 



Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 

To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or visit 
their Web page at www.us-cert.gov . 

Department of Homeland Security Disclaimer 

The DHS Daily Open Source Infrastructure Report is a non-commercial publication intended to educate and inform 
personnel engaged in infrastructure protection. Further reproduction or redistribution is subject to original copyright 
restrictions. DHS provides no warranty of ownership of the copyright, or accuracy with respect to the original source 
material. 
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